Remove security through obscurity measures: CSP URL is public.

Please make this a parameter so that it is actually configurable.